Effective Password Management in Source Code: Secure Solutions with sops and AWS KMS

About the Customer

Our customer specializes in the development of applications for processing sensitive data and places the highest priority on security—particularly in the management of passwords within source code. The customer was seeking efficient and reliable solutions to ensure that sensitive information is protected while maintaining smooth and uninterrupted workflows.

Challenge

The new solution is being developed with a strong focus on serverless services on Amazon Web Services. Users access the web frontend through a centralized user management system provided by AWS Cognito in combination with single sign-on (SSO) and Azure Active Directory. Deployment is handled using ECS Fargate and Next.js, with content stored in Amazon S3. Lambda functions act as interfaces to external data sources, S3, and the Aurora Serverless RDS database.

Solution

To address this challenge, the customer chose to implement sops (Secrets Operator) in combination with AWS Key Management Service (KMS).
Sops is an open-source tool that simplifies file encryption, while AWS KMS enables secure management of encryption keys.

The process began with the creation of an IAM user and a KMS key within the customer’s existing AWS account. Sops was then installed and configured to work with the KMS key.

Once the user and key were set up, the customer was able to encrypt and decrypt password files. Files containing environment variables (.yaml, .env, .json, etc.) were encrypted using the KMS key and a specified AWS profile, enabling seamless integration across different environments and working profiles.

An example command to encrypt a file is:
Sops -k $SOPS_KMS_ARN –aws-profile myProfile -e -i myFile.env
With this approach, the keys remained readable while the passwords were securely encrypted. This allowed the team to safely store sensitive data within the source code without compromising security.